IAPP CIPM Online Practice Questions and Exam Preparation

IAPP CIPM Online Questions & Answers

• Question 21:

  A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

  A. Statement of Auditing Standards (SAS) 70
  B. System ad Organization Controls (SOC) 1
  C. System ad Organization Controls (SOC) 2
  D. System ad Organization Controls (SOC) 3
  C. System ad Organization Controls (SOC) 2

  ---

  Explanation

• Question 22:

  An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization's security policies. What type of attack is this?

  A. Spoofing
  B. Spear phishing
  C. Piggybacking
  D. Insider threat
  B. Spear phishing

  ---

  Explanation

• Question 23:

  Improvements in an Input/output control (I/O control) system will most likely lead to:

  A. flattened bills of material (BOMs).
  B. a change in operation sequencing.
  C. reduction in queue size and queue time.
  D. fewer engineering change notifications.
  C. reduction in queue size and queue time.

  ---

  Explanation

  Input/Output (I/O) control focuses on managing the flow of work into and out of work centers to maintain a balanced workloaD: Improvements in I/O control typically lead to better scheduling, reduced bottlenecks, and ultimately a reduction in queue sizes and queue times, improving overall production efficiency.

• Question 24:

  An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?

  A. Remote using a Trusted Platform Module (TPM) due to better protection of the keys
  B. Local using Trusted Platform Module (TPM) because low-level access software can be accessed
  C. Local using Trusted Platform Module (TPM) because of benefits from Segregation Of Duties (SoD)
  D. Remote using a scanning device because of benefits from Segregation Of Duties (SoD)
  E. Local using Mobile Device Management (MDM) because of device policy enforcement
  A. Remote using a Trusted Platform Module (TPM) due to better protection of the keys

  ---

  Explanation

• Question 25:

  A cybersecurity analyst has recently been assigned to work with a product development team. The team has usually needed to perform a lot of rework late in the development cycle on past projects due to application security concerns. They would like to minimize the amount of rework necessary. Which would be the BEST option to enable secure code review early in the product development?

  A. Implement dynamic code analysis
  B. Perform manual code reviews
  C. Implement static code analysis
  D. Perform fuzz testing
  C. Implement static code analysis

  ---

  Explanation

• Question 26:

  To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

  A. Administrative detective
  B. Physical preventive
  C. Physical detective
  D. Administrative preventive
  B. Physical preventive

  ---

  Explanation

• Question 27:

  Which of the following BEST describes an individual modifying something the individual is not supposed to?

  A. Exfiltration
  B. Tampering
  C. Spoofing
  D. Repudiation
  B. Tampering

  ---

  Explanation

• Question 28:

  What is the FIRST element that must be evaluated in a security governance program?

  A. An organization's business objectives and strategy
  B. Review of Information Technology (IT) and technical controls
  C. Review of organization's Information Technology (IT) security policies
  D. An organization's utilization of resources
  A. An organization's business objectives and strategy

  ---

  Explanation

• Question 29:

  Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?

  A. History shows that the quality level has been stable from lot to lot.
  B. The company uses one of its qualified suppliers.
  C. Downstream operators encounter recurring defects.
  D. The percent of defects is expected to be greater than 5%.
  C. Downstream operators encounter recurring defects.

  ---

  Explanation

  When recurring defects are found downstream, it indicates that acceptance sampling is missing too many defective units, prompting a shift to 100% inspection to ensure product quality and prevent further issues.

• Question 30:

  One way to mitigate liability risk in the supply chain is to:

  A. negotiate lower component cost.
  B. require traceability for components.
  C. push inventory to supplier locations.
  D. use less-than-truckload (LTL) shipments more frequently.
  B. require traceability for components.

  ---

  Explanation

  Requiring traceability for components helps identify the origin and history of materials used in the supply chain. This is critical for mitigating liability risk, especially in the event of recalls, safety issues, or regulatory compliance investigations. It allows companies to respond quickly and accurately, limiting exposure to legal and financial consequences.